ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d

General

Target

ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
Size

20.9MB
MD5

ce19776b3080ba343b15fb57c2ce6c4c
SHA1

715a84fd2037d09c342d0c9290090e3c03bab36c
SHA256

ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d
SHA512

4cd5366344e4e37dd3e10f2cf5577c9f5871abfc4ef7753a11ac4ffc4ab53e1c64b5948e7f9e4c0896c32cb31370fff0483c1afe755fa28eb43ac345ecc40390
SSDEEP

393216:vwHS8l8YysvgWNIEaGvTjhgx4CnLz03wKwt9KD0+8l2m3SODgk6OlBwr:vwHSNcIvwjhgPg3BwPKDIl2miOQOG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

pid process

1312 ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

pid	process
1312	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

Loads dropped DLL 4 IoCs

Processes:

ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exeec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

pid	process
1648	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
1312	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
1312	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
1312	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

pid process

1312 ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

pid process

1312 ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

pid	process
1312	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

pid	process
1312	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

description	pid	process	target process
PID 1648 wrote to memory of 1312	1648	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
PID 1648 wrote to memory of 1312	1648	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
PID 1648 wrote to memory of 1312	1648	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
PID 1648 wrote to memory of 1312	1648	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe	ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe

C:\Users\Admin\AppData\Local\Temp\ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
"C:\Users\Admin\AppData\Local\Temp\ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\temp1\ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
"C:\Users\Admin\AppData\Local\Temp\temp1\ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe" /CUSTOMPARAM=C:\Users\Admin\AppData\Local\Temp\temp1\m-ipod-to-pc-transfer-for-win.exe_CUSTOMEDATA
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1312

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyBD6.tmp\installmode.ini
Filesize
562B

MD5
7bbd3df3683a8a926f3d0f07eac0f205

SHA1
54fed79b1b448743fa16e6340c4c6bb81d103bc4

SHA256
02daa877f3b06c4cecd512c83734385693a59093b4d7f6b60513a0c53b3c3183

SHA512
824705b62ee9ed5e8fc289bfae73958ba4cf673c0400658d2e72ca1a14ca347fc036ba1c4d6d9bbfd0eda82e9896b2e044d86f04a6de4363b75be89f33533c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
Filesize
20.8MB

MD5
d9bf91141b829309db8c8e71f09866a7

SHA1
36cc1bb2cd1aa96aad1e182cb946bbb6dfd07abf

SHA256
f4f9d832354364e25529d5a035a54186a8cf1f8482e12bcf0c6b1aff75d7f2ef

SHA512
ca6513cd3095106c5a9c0e70103788ebf9cdc1ea56869231100eec972652e68cba7dbd0379d6740d7d8b5fb2f1bcf8e27930fea9f3693fb1db057e6907174ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1\ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
Filesize
20.8MB

MD5
d9bf91141b829309db8c8e71f09866a7

SHA1
36cc1bb2cd1aa96aad1e182cb946bbb6dfd07abf

SHA256
f4f9d832354364e25529d5a035a54186a8cf1f8482e12bcf0c6b1aff75d7f2ef

SHA512
ca6513cd3095106c5a9c0e70103788ebf9cdc1ea56869231100eec972652e68cba7dbd0379d6740d7d8b5fb2f1bcf8e27930fea9f3693fb1db057e6907174ce4

Download Submit
\Users\Admin\AppData\Local\Temp\nsyBD6.tmp\InstallOptions.dll
Filesize
15KB

MD5
1d8ade5c04339687340b9b4cb6b7854e

SHA1
f43e24e8615402161fdac02f9fb396808cc42afa

SHA256
83bf9c630141db8531d1c83bc783a79965f0e3438c84ab98f464fff2441c6f71

SHA512
121e7be13e120b1a1e958c6fb530cc642f8585190e0c9d44982d3337980c41742e1e455636005f01c7461ba365789d8bf9247643ab72620011ff31e684d8ef32

Download Submit
\Users\Admin\AppData\Local\Temp\nsyBD6.tmp\LangDLL.dll
Filesize
4KB

MD5
12a4553bfb677393b102e5784a56cc39

SHA1
e16d55cffc5e2a5e891f3c5159fef5f2676dc639

SHA256
7309efa056b8958d5de7ebb4a96c00a92d3cf932a83beec721243f1649bbb3d5

SHA512
42a71229111a377f128e7d69dcddcf4a82f940c3e837519f6fede029596b8964ea27a3e52b8aa4f115182046ebdda227d8d2e9b11fc9a63c0e655325fad3e75e

Download Submit
\Users\Admin\AppData\Local\Temp\nsyBD6.tmp\Processes.dll
Filesize
35KB

MD5
53c49f56c890b3fc52318a0342008813

SHA1
45ad45f8c3ce765a96f8228f7038feb7db114c23

SHA256
48e2706c457b9d91fd36d07e20c6130864a16763b33f78c8dd8282c85b7eb3af

SHA512
7eb4c146ce9ccba47d489d8221ecba8a8a37681a27c22228aa52f56116cb3d4f726cb0c85c2448a7ef300f02abf12d1e03ca0f3b827958492983c9cd69e8c9ee

Download Submit
\Users\Admin\AppData\Local\Temp\temp1\ec5c6ebb06fcb4fb23996beb88d3053c79782eab94ce33eb9e3d6bf0c2ee2d7d.exe
Filesize
20.8MB

MD5
d9bf91141b829309db8c8e71f09866a7

SHA1
36cc1bb2cd1aa96aad1e182cb946bbb6dfd07abf

SHA256
f4f9d832354364e25529d5a035a54186a8cf1f8482e12bcf0c6b1aff75d7f2ef

SHA512
ca6513cd3095106c5a9c0e70103788ebf9cdc1ea56869231100eec972652e68cba7dbd0379d6740d7d8b5fb2f1bcf8e27930fea9f3693fb1db057e6907174ce4

Download Submit

Analysis

Sharing